posterly-mcp-server 0.3.0 → 0.3.1

package/dist/index.js

@@ -13,7 +13,7 @@ import { deletePostTool } from './tools/delete-post.js';
 import { whoamiTool } from './tools/whoami.js';
 const server = new McpServer({
     name: 'posterly',
-    version: '0.3.0',
+    version: '0.3.1',
 });
 let client;
 try {

package/dist/tools/create-post.js

@@ -1,7 +1,13 @@
 import { z } from 'zod';
 export const createPostTool = {
     name: 'create_post',
-    description: 'Schedule or immediately publish a social media post. Provide either account_id OR username+platform to identify the account. If scheduled_at is omitted, the post publishes immediately. IMPORTANT: posts belong to a workspace. If workspace_id is omitted, the server resolves one from the social account, falling back to the caller\'s default (personal) workspace. Call `whoami` first in any new session to confirm which workspace posts will land in, and pass workspace_id explicitly if the user has more than one workspace.',
+    description: 'Schedule or immediately publish a social media post. This is a DESTRUCTIVE WRITE that creates content on the user\'s real social accounts — once scheduled_at passes, it will be posted publicly and cannot be un-posted.\n\n' +
+        'REQUIRED BEFORE CALLING:\n' +
+        '1. Call `whoami` at the start of any new session to confirm which workspace and user you are acting for.\n' +
+        '2. Show the user a preview containing ALL of: account(s) and platform(s), final caption text, scheduled time (in the user\'s timezone), media attached (if any), and workspace name.\n' +
+        '3. Get explicit confirmation from the user (e.g. "post it", "yes schedule that", "looks good") BEFORE calling this tool. Do NOT infer consent from earlier instructions like "post about X every Monday" — confirm each individual post or the entire batch.\n' +
+        '4. If scheduling multiple posts in one turn, list every post first and confirm the batch as a whole before calling create_post repeatedly.\n\n' +
+        'Provide either account_id OR username+platform to identify the account. If scheduled_at is omitted, the post publishes immediately. If workspace_id is omitted, the server resolves one from the social account, falling back to the caller\'s default (personal) workspace — pass workspace_id explicitly if the user has more than one workspace.',
     inputSchema: z.object({
         account_id: z.string().optional().describe('Social account ID (from list_accounts)'),
         username: z.string().optional().describe('Account username (alternative to account_id)'),

package/dist/tools/delete-post.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 export const deletePostTool = {
     name: 'delete_post',
-    description: 'Delete a scheduled or draft post. Cannot delete published or currently publishing posts.',
+    description: 'Delete a scheduled or draft post. DESTRUCTIVE and IRREVERSIBLE — the post and its caption cannot be recovered. Cannot delete published or currently publishing posts.\n\n' +
+        'REQUIRED BEFORE CALLING: Fetch the post with `get_post` first and show the user what will be deleted (caption, account, scheduled time). Get explicit confirmation ("yes delete it", "remove it") before calling. Never delete multiple posts in a single batch without listing each one and confirming the full list.',
     inputSchema: z.object({
         post_id: z.number().describe('The post ID to delete'),
     }),

package/dist/tools/update-post.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 export const updatePostTool = {
     name: 'update_post',
-    description: 'Update a scheduled or draft post. Can change caption, scheduled time, media, or post type. Cannot edit published or currently publishing posts.',
+    description: 'Update a scheduled or draft post. DESTRUCTIVE WRITE — overwrites the existing post\'s caption/media/schedule. Cannot edit published or currently publishing posts.\n\n' +
+        'REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media) and the PROPOSED changes, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction — each edit needs its own confirmation.',
     inputSchema: z.object({
         post_id: z.number().describe('The post ID to update'),
         caption: z.string().optional().describe('New caption/text content'),

package/dist/tools/upload-media.js

@@ -1,7 +1,9 @@
 import { z } from 'zod';
 export const uploadMediaTool = {
     name: 'upload_media',
-    description: 'Upload an image or video file to posterly. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB. IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path.',
+    description: 'Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB.\n\n' +
+        'This writes to the user\'s media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe — it\'s the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements.\n\n' +
+        'IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path — never guess paths.',
     inputSchema: z.object({
         file_path: z
             .string()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "MCP server for posterly — schedule social media posts from Claude Desktop",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -15,7 +15,7 @@ import { whoamiTool } from './tools/whoami.js';
 
 const server = new McpServer({
   name: 'posterly',
-  version: '0.3.0',
+  version: '0.3.1',
 });
 
 let client: PosterlyClient;

package/src/tools/create-post.ts

@@ -4,7 +4,13 @@ import type { PosterlyClient } from '../lib/api-client.js';
 export const createPostTool = {
   name: 'create_post',
   description:
-    'Schedule or immediately publish a social media post. Provide either account_id OR username+platform to identify the account. If scheduled_at is omitted, the post publishes immediately. IMPORTANT: posts belong to a workspace. If workspace_id is omitted, the server resolves one from the social account, falling back to the caller\'s default (personal) workspace. Call `whoami` first in any new session to confirm which workspace posts will land in, and pass workspace_id explicitly if the user has more than one workspace.',
+    'Schedule or immediately publish a social media post. This is a DESTRUCTIVE WRITE that creates content on the user\'s real social accounts — once scheduled_at passes, it will be posted publicly and cannot be un-posted.\n\n' +
+    'REQUIRED BEFORE CALLING:\n' +
+    '1. Call `whoami` at the start of any new session to confirm which workspace and user you are acting for.\n' +
+    '2. Show the user a preview containing ALL of: account(s) and platform(s), final caption text, scheduled time (in the user\'s timezone), media attached (if any), and workspace name.\n' +
+    '3. Get explicit confirmation from the user (e.g. "post it", "yes schedule that", "looks good") BEFORE calling this tool. Do NOT infer consent from earlier instructions like "post about X every Monday" — confirm each individual post or the entire batch.\n' +
+    '4. If scheduling multiple posts in one turn, list every post first and confirm the batch as a whole before calling create_post repeatedly.\n\n' +
+    'Provide either account_id OR username+platform to identify the account. If scheduled_at is omitted, the post publishes immediately. If workspace_id is omitted, the server resolves one from the social account, falling back to the caller\'s default (personal) workspace — pass workspace_id explicitly if the user has more than one workspace.',
   inputSchema: z.object({
     account_id: z.string().optional().describe('Social account ID (from list_accounts)'),
     username: z.string().optional().describe('Account username (alternative to account_id)'),

package/src/tools/delete-post.ts

@@ -4,7 +4,8 @@ import type { PosterlyClient } from '../lib/api-client.js';
 export const deletePostTool = {
   name: 'delete_post',
   description:
-    'Delete a scheduled or draft post. Cannot delete published or currently publishing posts.',
+    'Delete a scheduled or draft post. DESTRUCTIVE and IRREVERSIBLE — the post and its caption cannot be recovered. Cannot delete published or currently publishing posts.\n\n' +
+    'REQUIRED BEFORE CALLING: Fetch the post with `get_post` first and show the user what will be deleted (caption, account, scheduled time). Get explicit confirmation ("yes delete it", "remove it") before calling. Never delete multiple posts in a single batch without listing each one and confirming the full list.',
   inputSchema: z.object({
     post_id: z.number().describe('The post ID to delete'),
   }),

package/src/tools/update-post.ts

@@ -4,7 +4,8 @@ import type { PosterlyClient } from '../lib/api-client.js';
 export const updatePostTool = {
   name: 'update_post',
   description:
-    'Update a scheduled or draft post. Can change caption, scheduled time, media, or post type. Cannot edit published or currently publishing posts.',
+    'Update a scheduled or draft post. DESTRUCTIVE WRITE — overwrites the existing post\'s caption/media/schedule. Cannot edit published or currently publishing posts.\n\n' +
+    'REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media) and the PROPOSED changes, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction — each edit needs its own confirmation.',
   inputSchema: z.object({
     post_id: z.number().describe('The post ID to update'),
     caption: z.string().optional().describe('New caption/text content'),

package/src/tools/upload-media.ts

@@ -4,7 +4,9 @@ import type { PosterlyClient } from '../lib/api-client.js';
 export const uploadMediaTool = {
   name: 'upload_media',
   description:
-    'Upload an image or video file to posterly. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB. IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path.',
+    'Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB.\n\n' +
+    'This writes to the user\'s media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe — it\'s the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements.\n\n' +
+    'IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path — never guess paths.',
   inputSchema: z.object({
     file_path: z
       .string()